-
Notifications
You must be signed in to change notification settings - Fork 53
Open
Description
Currently, SharpHound always uses RegistryKey.OpenRemoteBaseKey to read registry values
| var remoteKey = await _adaptiveTimeout.ExecuteWithTimeout((_) => RegistryKey.OpenRemoteBaseKey(hive, machineName)); |
However, there are scenarios where a standard user runs SharpHound directly on a Domain Controller or another target machine. In these cases, the call to
OpenRemoteBaseKey often fails because it requires the Remote Registry service and appropriate remote permissions, which standard users typically lack.On the other hand, the same user may have sufficient rights to read the local registry. Therefore, adding a check to determine if
machineName refers to the local machine and using RegistryKey.OpenBaseKey instead would significantly improve data collection success rates.Metadata
Metadata
Assignees
Labels
No labels